Security notice

Do you shop or sell on a marketplace that keeps addresses and points? Qoo10 says an outsider viewed some customer data, and has not published a count.

Last updated: Saturday, November 14, 2026, 8:15 AM ETStatus: Breach disclosed. Customer data may have been viewed. Count unpublished.

On November 12, 2026, Qoo10 published a notice on its Japanese marketplace, qoo10.jp, titled as a security incident and personal information leak. The company, which is operated by eBay Japan, said an outside third party gained unauthorized access to its systems on November 6 and viewed some personal information. ITmedia describes Qoo10 as a major Japanese shopping mall with more than 30 million members. Qoo10's own notice does not give a membership total, and it has not said how many accounts were involved. The notice says information that may have been accessed includes data collected through ordinary transactions and data customers provided themselves. The types that may be involved include names, nicknames, contact information (including email addresses and phone numbers), dates of birth, gender, profile information, addresses and shipping addresses, geographic coordinates of addresses, customer segment information, physical characteristics that customers chose to enter, account identifiers, IP addresses, personal notes, and on-site point balances. Qoo10 says that, as of the notice, it had not confirmed evidence that payment information or passwords were leaked. After detecting the access, it says it blocked it at once, invalidated authentication tokens that may have been improperly issued or used, and forced a logout of accounts that may have been affected. It says a detailed investigation is continuing, and it warns customers about impersonation and unexpected phone calls, text messages and emails. This is not a named software flaw, so there is no CVE or patch to install. If you shop or sell on Qoo10, use official pages and watch for phishing. If you run a store, this is a reminder that addresses, map coordinates, notes, points and profile details are enough to make a scam convincing, and that you should be able to invalidate login sessions quickly. (Qoo10 official notice, Nov 12; ITmedia NEWS, Nov 13)

What happened

Accessed on November 6, announced on November 12. Qoo10's official notice, dated November 12, 2026, says an outside third party gained unauthorized access to the company's systems on November 6 and viewed some personal information. The notice is posted on qoo10.jp, Qoo10's Japanese marketplace. The company's site identifies Qoo10 as an eBay company, and ITmedia says it is operated by eBay Japan. (Qoo10 official notice, Nov 12; ITmedia NEWS, Nov 13)
What data may have been viewed. The company says information that may have been accessed includes data obtained through ordinary transactions and data customers provided themselves. It says the personal information that may be involved may include names, nicknames, contact information including email addresses and phone numbers, dates of birth, gender, profile information, addresses and shipping addresses, geographic coordinates of addresses, customer segment information, physical characteristics that customers optionally entered, account identification information, IP addresses, personal notes, and on-site point balances. That list means those types may be among the data, not that every item was viewed for every customer. (Qoo10 official notice, Nov 12)
No published count. The official notice does not say how many accounts or people were involved, and it does not say how a shopper can check whether their own account was affected. ITmedia describes Qoo10 as having more than 30 million members. That figure is not a count of people affected by this incident, and it does not appear in Qoo10's notice. (Qoo10 official notice, Nov 12; ITmedia NEWS, Nov 13)
Payment data and passwords. The company says that, as of the November 12 notice, it had not confirmed evidence that payment information or passwords were leaked. (Qoo10 official notice, Nov 12)
Access blocked, tokens invalidated, accounts logged out. Qoo10 says that after it detected the unauthorized access, it blocked it at once, invalidated all authentication tokens that may have been improperly issued or used, and forced a logout of accounts that may have been affected, to limit further harm. It says a detailed investigation is still under way. The notice does not say how the attacker got in. (Qoo10 official notice, Nov 12)
Phishing warning. The company warns that secondary harm may include impersonation and unexpected phone calls, text messages and emails, and it asks customers not to open links in messages from senders they cannot verify. The official notice lists contact desks for shoppers and for sellers. (Qoo10 official notice, Nov 12)

Who should worry

You have a Qoo10 account on the Japanese marketplace, or you have shopped or sold there.
You run an online store or sell on a marketplace, and you keep customer names, contacts, addresses, map coordinates, notes, points or profile details.

If you have never used Qoo10 Japan and you do not run a store that keeps this kind of customer data, this notice does not apply to you. This notice is about the Japanese marketplace at qoo10.jp. Qoo10's November 12 notice does not say that marketplaces in other countries were involved.

What to do now

If you shop or sell on Qoo10. This follows the company's own notice.

Use official pages. Go to qoo10.jp yourself, or use the contact desks listed in the official notice. Do not use a link from an unexpected message. (Qoo10 official notice, Nov 12)
Watch for impersonation. The company warns that this incident may be followed by fake calls, texts and emails. Do not open links from senders you cannot verify, and do not give anyone a password, a card number, a one-time code or your points login. (Qoo10 official notice, Nov 12)
You may have been logged out. Qoo10 says it forced a logout of accounts that may have been affected and invalidated authentication tokens. If you were logged out, sign in again only on the official site or official app. (Qoo10 official notice, Nov 12)
Wait for Qoo10 if it has something specific to tell you. The company has not published a count, and the notice does not say whether or how individual shoppers will be notified. Do not assume your data was viewed, and do not assume it was not. (Qoo10 official notice, Nov 12)
If you reuse the same password on other sites, consider changing those passwords. Qoo10 has not found evidence that passwords were leaked and has not told customers they must change their Qoo10 password. Reusing a password on other sites is still a risk worth reducing.

If you run an online store, or you sell on a marketplace. These are general steps, not from Qoo10. We are not claiming any tool, including EverThread, would have stopped this attack.

Look at the customer data you still keep, including unusual fields. This notice lists geographic coordinates of addresses, optional physical characteristics, personal notes, customer segment data and point balances, not only names and emails. If you geocode addresses, keep free-text notes, or store points and profile attributes, treat those as personal data you may have to explain after a breach. Delete fields you do not need.
Have a way to cut off login sessions quickly. Qoo10 says it invalidated authentication tokens and forced a logout of accounts that may have been affected. Know in advance how you would revoke sessions or tokens for your own shop or for a marketplace you sell on, and who can approve that step.
Warn customers about impersonation, not only about the missing data. Names, addresses, delivery details and points balances are enough to make a fake "confirm your order" or "your points will expire" message look real. Prepare that warning before you need it.
If you sell on Qoo10, follow the official seller desk in the company's notice, and be careful with any unexpected message that claims to be from Qoo10 about this incident.

What to send your developer, agency or host

Qoo10, the Japanese marketplace operated by eBay Japan, said on November 12, 2026, that an outside third party gained unauthorized access to its systems on November 6 and viewed some personal information. The company has not published a count. It says the data that may be involved can include names, contacts, dates of birth, addresses and their geographic coordinates, profile and segment details, optional physical characteristics, account identifiers, IP addresses, personal notes and point balances, and that it has not confirmed evidence that payment information or passwords were leaked. It says it blocked the access, invalidated authentication tokens and forced a logout of accounts that may have been affected. Please tell us what customer data our store or marketplace account still keeps, including addresses, geocoded locations, notes, points, profile fields and any optional physical or segment data, which of those fields we can delete, and how we would invalidate login sessions or tokens and warn customers about phishing if we had a similar incident. Sources: Qoo10 official notice, November 12, 2026; ITmedia NEWS, November 13, 2026.

Common questions

Does this mean my site was hacked?

No. This notice is about a breach Qoo10 confirmed at its own Japanese marketplace. It does not mean your site was hacked. It matters to you if you shop or sell on Qoo10, and as a store owner because many shops keep the same kinds of customer data.

Can EverThread tell me if I am affected?

No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see Qoo10's customer records, and we cannot tell you whether your Qoo10 account was involved.

Were payment details or passwords stolen?

Qoo10 says that, as of its November 12 notice, it had not confirmed evidence that payment information or passwords were leaked. That is not the same as a guarantee that they were not. The company is still investigating. Watch for official updates, and be careful with unexpected payment or password messages.

How many people were affected?

Qoo10 has not published a count. ITmedia's "more than 30 million members" figure describes the size of the marketplace, not the number of people involved in this incident. (ITmedia NEWS, Nov 13)

How did the attacker get in?

Qoo10 has not said. It says a detailed investigation is continuing. (Qoo10 official notice, Nov 12)

Is this only about Qoo10 in Japan?

The official notice we are following is on qoo10.jp, the Japanese marketplace. The notice does not say that Qoo10 sites in other countries were involved.

Is there anything to update?

No. This was an attack on one company's systems, not a named flaw in software you run. The general steps for store owners above are worth doing anyway.

Where can I follow official updates?

Qoo10's November 12 notice, "Notice regarding a security incident and personal information leak," is on qoo10.jp. ITmedia NEWS reported the incident on November 13, 2026, including that eBay Japan operates the marketplace. All current notices are on our notices page.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

Sources

Qoo10 official notice: Notice regarding a security incident and personal information leak, November 12, 2026, checked November 14, 2026.
ITmedia NEWS: Qoo10 unauthorized access and personal information leak; geographic coordinates of addresses and physical characteristics may also be involved, November 13, 2026, checked November 14, 2026.